If you’ve ever had a particularly nasty fracture, your doctor may have prescribed the use of an electronic bone growth stimulator. These wearable devices produce a pulsed electromagnetic field around the bone, which has been shown to speed up the natural healing process in a statistically significant number of patients. That’s not to say there isn’t a debate about how effective they actually are, but studies haven’t shown any downsides to the therapy, so it’s worth trying at least.
When you receive one of these devices, it will be programmed to only operate for a certain amount of time or number of sessions. Once you’ve “used up” the bone stimulator, it’s functionally worthless. As you might imagine, there’s no technical reason this has to be the case. The cynic would say the only reason these devices have an expiration date on them is because the manufacturer wants to keep them from hitting the second hand market, but such a debate is perhaps outside the scope of these pages.
The Orthofix SpinalStim you’re seeing here was given to me by a friend after their doctor said the therapy could be cut short. This provided a somewhat rare opportunity to observe the device before it deactivated itself, which I’d hoped would let me take a closer look at how it actually operated.
As you’ll soon see, things unfortunately didn’t work out that way. But that doesn’t mean the effort was fruitless, and there may yet be hope for hacking these devices should anyone feel like taking up the challenge.
Keeping it Simple
Since the SpinalStim is designed to produce an electromagnetic field around the spine, it’s not hard to guess that the foam-covered “back brace” contains some kind of coil. But being a high-tech medical device, you might imagine there’s some exotic materials or techniques involved. As it turns out, there isn’t.
Cutting the foam lining away from the brace in an operation not entirely unlike gutting a fish, we can see there’s nothing very special going on here. It’s just a dozen or so loops of two conductor insulated wire that’s held together with, as far as I can tell, painter’s masking tape.
It’s not even like they made a neat coil; pulling the rest off the foam off, there are areas where the wires overlap a bit. I would have thought they’d use some kind of flexible loom to hold the wires in place, but apparently the foam of the brace itself was considered enough to keep the wires flat.
Taking a close look at the four pin connector that goes into the back of the control unit, we can see that the wires have actually been twisted together and crimped to both conductors in the yellow cable. The loop itself is connected to another identical arrangement located on the other side of the brace by a wire hidden in one of the straps that holds them together.
Taking Control
With construction techniques not far removed from a grade school science project, I’ll admit the coils were something of a letdown. But luckily the Control Unit is a bit more interesting. As the SpinalStim has no patient-accessible settings, this device is simplistic in the extreme: just a single button to turn it on and off and a USB-B port for charging. It does however have a rather nice LCD display that indicates the battery level and how much treatment time is left. The screen is even backlit, which seems somewhat unnecessary, but is perhaps beneficial for elderly users who might have trouble seeing the display otherwise.
Both inside and out, the Control Unit is much closer to what I was expecting from a medical device. It’s got considerable heft thanks to internal battery pack, and the thick enclosure with o-ring seals is really quite impressive. Between all the wire you can pull from the coils and this beefy electronics enclosure, there’s a surprising amount of salvage value in this device already.
On the reverse side of the PCB, we can see a few interesting details. Chief among them are the dedicated programming headers for the device’s STM32 microcontroller and nRF Bluetooth Low Energy chipset. We usually have to hunt around for useful debug or programming interfaces, so to see them not only labelled but actually populated with pins is really a treat. We can also see the backup battery used to keep the device’s internal timer ticking even if the primary battery dies, and a bank of capacitors that are likely used to build up a charge to fire through the coil.
Peeling the firmware release sticker off of the microcontroller reveals it to be the very common STM32F103, and removing the board’s RF shield uncovers another chip Hackaday readers will likely be familiar with, the nRF51822. The presence of these well documented chips certainly bodes well for any potential reverse engineering or repurposing of the device.
An Investigation Cut Short
At this point, I was hoping to get the Orthofix SpinalStim hooked up to the oscilloscope and take a look at what kind of signal it was passing through the coil, but it was not to be. After putting the Control Unit back together, I’m now immediately greeted with an angry beep and an error message.
Just like the VeriFone MX 925CTLS payment terminal we looked at last year, it would seem the SpinalStim is designed to “self-destruct” once it’s been opened. I didn’t notice any obvious triggers like we saw in the VeriFone, but I’m assuming when I disconnected the battery it was enough for the device to realize something was amiss. This is probably designed to prevent users from trying to reset the device’s internal counter, which seems to have been a problem on older bone stimulators.
While I’m disappointed the SpinalStim swallowed its cyanide pill rather than submit to further interrogation, the hardware uncovered in the Control Unit certainly looks ripe for further hacking. We’ve seen medical devices reverse engineered to unlock new capabilities in the past, and while there might not be a huge demand for a FOSS bone growth simulator firmware, it seems the possibility is there for anyone who wants to free these devices from their arbitrary limitations.
